diff --git a/python3/httplib2/__init__.py b/python3/httplib2/__init__.py
index 43f7419..856e2b6 100644
--- a/python3/httplib2/__init__.py
+++ b/python3/httplib2/__init__.py
@@ -827,18 +827,26 @@ def __init__(self, host, port=None, key_file=None, cert_file=None,
                  timeout=None, proxy_info=None,
                  ca_certs=None, disable_ssl_certificate_validation=False):
         self.proxy_info = proxy_info
-        context = None
         if ca_certs is None:
             ca_certs = CA_CERTS
-        if (cert_file or ca_certs) and not disable_ssl_certificate_validation:
-            if not hasattr(ssl, 'SSLContext'):
+        if disable_ssl_certificate_validation:
+            if hasattr(ssl, 'SSLContext'):
+                context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
+                context.verify_mode = ssl.CERT_OPTIONAL
+                context.load_default_certs()
+            else:
+                context = None
+        else:
+            if hasattr(ssl, 'SSLContext'):
+                context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
+                context.verify_mode = ssl.CERT_REQUIRED
+                context.load_default_certs()
+                if cert_file:
+                    context.load_cert_chain(cert_file, key_file)
+                if ca_certs:
+                    context.load_verify_locations(ca_certs)
+            else:
                 raise CertificateValidationUnsupportedInPython31()
-            context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
-            context.verify_mode = ssl.CERT_REQUIRED
-            if cert_file:
-                context.load_cert_chain(cert_file, key_file)
-            if ca_certs:
-                context.load_verify_locations(ca_certs)
         http.client.HTTPSConnection.__init__(
                 self, host, port=port, key_file=key_file,
                 cert_file=cert_file, timeout=timeout, context=context,